Services going down every 5 mins or so

[rxerium]

Hi there,

Some services keep restarting / going down intermittently on my cloud VPS running 16GB RAM / 6vCPU cores / 400GB SSD. See the below information which might be helpful.

⚠️ Basic support information (commands are expected to run as root)

• What version of the OS are you currently using lsb_release -a and uname -a?
  Ubuntu 22.04.3 LTS

• What T-Pot version are you currently using?
  I just installed it so the latest version.

• What edition (Standard, Nextgen, etc.) of T-Pot are you running?
  Standard

• What architecture are you running on (i.e. hardware, cloud, VM, etc.)?
  Cloud VPS

• Did you have any problems during the install? If yes, please attach /install.log /install.err.
  Yes when running ./install.sh I get Aborting. Debian jammy is not supported so I modified the installer. See below.

• How long has your installation been running?
  1 hour

• Did you install upgrades, packages or use the update script?
  Prior to running the script yes

• Did you modify any scripts or configs? If yes, please attach the changes.
  Yes, changed mySUPPORT="FALSE" to mySUPPORT="TRUE" in file ./install.sh line 364

• Please provide a screenshot of glances and htop.
  
  

• How much free disk space is available (df -h)?
  360GB

• What is the current container status (dps.sh)?
  

• What is the status of the T-Pot service (systemctl status tpot)?
  

• What ports are being occupied? Stop T-Pot systemctl stop tpot and run netstat -tulpen
  

• If a single container shows as DOWN you can run docker logs <container-name> for the latest log entries
  

[rxerium]

Okay I think its working, but should I have any more services available to me or is this everything? Looks like im missing Kibana

Edit: It keeps going down again. I've ran some intrusive scans against the honeypot and the map does not pick it up.

[rxerium]

Hey all, any updates here? Happy to provide more details where necessary

[cah117]

This happened to me just today after editing the Cowrie docker-compose file and running docker-compose up -d --no-deps --force-recreate within the /opt/tpot/docker/cowrie/ directory. This broke everything BUT Cowrie it seems, because it is now the ONLY container that doesn't restart every 2 minutes.

The solution I found: Run update.sh -y from /opt/tpot/ which resolved the problems by reverting all of the scripts and docker-compose files back to their defaults. All old logs were still there from before the services starting crashing.

Edit - Disregard this:
The Cowrie container is read-only by default in the docker-compose file. But if you make it writable to add your own files to fs.pickle and rerun docker-compose, that breaks everything else it seems because that was literally the only change I made on a second test of this. So, yeah, I'm not sure how you're supposed to customize the Cowrie honeypot if you can't write to it, either within the container directly or through docker cp.

I see now, I guess I should have been updating the docker compose section for Cowrie at /opt/tpot/etc/tpot.yml instead.